My Auctions Allegro
Monthly
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the WordPress plugin 'My auctions allegro' (free edition) through version 3.6.35, allowing attackers to inject malicious scripts into web pages viewed by victims. An unauthenticated attacker can craft a malicious URL containing JavaScript code that executes in the victim's browser when clicked, potentially stealing session cookies, redirecting users, or performing actions on behalf of the user. No CVSS score, EPSS score, or KEV status has been assigned, and patch availability status is unclear, though the vulnerability was identified and reported by Patchstack security researchers.
Broken access control in the WordPress plugin My Auctions Allegro (free edition), versions through 4.0.3, allows a logged-in low-privilege user such as a subscriber to invoke plugin functionality that should be restricted to higher roles, yielding limited data exposure and limited unauthorized modification. The flaw is a missing authorization check (CWE-862) rated CVSS 5.4 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, so anonymous visitors cannot exploit it, but any account on the site can serve as the starting point. No public exploit code or active exploitation has been reported, and the specific endpoint or feature that exposes the unprotected function is not described in the available sources.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the WordPress plugin 'My auctions allegro' (free edition) through version 3.6.35, allowing attackers to inject malicious scripts into web pages viewed by victims. An unauthenticated attacker can craft a malicious URL containing JavaScript code that executes in the victim's browser when clicked, potentially stealing session cookies, redirecting users, or performing actions on behalf of the user. No CVSS score, EPSS score, or KEV status has been assigned, and patch availability status is unclear, though the vulnerability was identified and reported by Patchstack security researchers.
Broken access control in the WordPress plugin My Auctions Allegro (free edition), versions through 4.0.3, allows a logged-in low-privilege user such as a subscriber to invoke plugin functionality that should be restricted to higher roles, yielding limited data exposure and limited unauthorized modification. The flaw is a missing authorization check (CWE-862) rated CVSS 5.4 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, so anonymous visitors cannot exploit it, but any account on the site can serve as the starting point. No public exploit code or active exploitation has been reported, and the specific endpoint or feature that exposes the unprotected function is not described in the available sources.